Passports for Software
mTLS requires certificates, and certificates must identify someone. But who? In Kubernetes, pods are ephemeral — they start and stop constantly, and their IP addresses change every time. You cannot use an IP address as a stable identity.
SPIFFE (Secure Production Identity Framework For Everyone) is an open standard that defines a portable, cryptographically verifiable identity for software workloads. It answers the question: "How does a service prove what it is, not just where it is?"
A SPIFFE ID is a URI with a specific format:
spiffe://<trust-domain>/<workload-path>
In a Kubernetes cluster managed by Istio, a SPIFFE ID looks like this:
spiffe://cluster.local/ns/payments/sa/payment-service
Breaking this down:
- cluster.local — the trust domain (your cluster's identity boundary)
- ns/payments — the Kubernetes namespace
- sa/payment-service — the Kubernetes ServiceAccount the pod runs as
When the mesh issues an mTLS certificate to a pod, it embeds this SPIFFE ID in the certificate's Subject Alternative Name (SAN) field. This is a standard X.509 certificate field, so no special tooling is needed to read it.
How authorization works in practice:
Service B receives an inbound mTLS connection. Its Envoy sidecar extracts the SPIFFE ID from the caller's certificate:
spiffe://cluster.local/ns/frontend/sa/frontend-service
It then checks the mesh's authorization policy — a rule scoped to the payment-service workload that explicitly allows inbound traffic only from callers presenting that specific frontend-service principal, and denies everyone else by default.
This policy says: "Only allow connections whose mTLS certificate contains the SPIFFE ID for frontend-service." Any other caller — even one running inside the cluster — is denied. This is zero-trust networking: every request must be authenticated and authorized, regardless of network location.
SVID (SPIFFE Verifiable Identity Document) is the term for the actual artifact (the X.509 certificate or JWT) that carries the SPIFFE ID. The component responsible for issuing and rotating SVIDs is called a SPIRE (SPIFFE Runtime Environment) server, though in Istio, istiod plays this role directly.